[Backport] Security bug 384565015

Manual cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/v8/v8/+/6098197:
[wasm][arm][tail-call] Free scratch register earlier

In Liftoff's PrepareTailCall, we kept the UseScratchRegisterScope open
for longer than necessary. Close the scope earlier to ensure that we
don't run out of scratch registers in the last "sub" instruction if it
needs one.

[email protected]

Fixed: 384565015
Change-Id: Ib36c515f5aca7d0c5899564d474cb3be6e0d9f85
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6098197
Reviewed-by: Clemens Backes <[email protected]>
Commit-Queue: Thibaud Michaud <[email protected]>
Cr-Commit-Position: refs/heads/main@{#97846}
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/615717
Reviewed-by: Anu Aliyas <[email protected]>

Author: thibaudmichaud

chromium/v8/src/wasm/baseline/arm/liftoff-assembler-arm.h

@@ -493,21 +493,23 @@ void LiftoffAssembler::CallFrameSetupStub(int declared_function_index) {
 
 void LiftoffAssembler::PrepareTailCall(int num_callee_stack_params,
                                        int stack_param_delta) {
-  UseScratchRegisterScope temps(this);
-  Register scratch = temps.Acquire();
-
-  // Push the return address and frame pointer to complete the stack frame.
-  sub(sp, sp, Operand(8));
-  ldr(scratch, MemOperand(fp, 4));
-  str(scratch, MemOperand(sp, 4));
-  ldr(scratch, MemOperand(fp, 0));
-  str(scratch, MemOperand(sp, 0));
-
-  // Shift the whole frame upwards.
-  int slot_count = num_callee_stack_params + 2;
-  for (int i = slot_count - 1; i >= 0; --i) {
-    ldr(scratch, MemOperand(sp, i * 4));
-    str(scratch, MemOperand(fp, (i - stack_param_delta) * 4));
+  {
+    UseScratchRegisterScope temps(this);
+    Register scratch = temps.Acquire();
+
+    // Push the return address and frame pointer to complete the stack frame.
+    sub(sp, sp, Operand(8));
+    ldr(scratch, MemOperand(fp, 4));
+    str(scratch, MemOperand(sp, 4));
+    ldr(scratch, MemOperand(fp, 0));
+    str(scratch, MemOperand(sp, 0));
+
+    // Shift the whole frame upwards.
+    int slot_count = num_callee_stack_params + 2;
+    for (int i = slot_count - 1; i >= 0; --i) {
+      ldr(scratch, MemOperand(sp, i * 4));
+      str(scratch, MemOperand(fp, (i - stack_param_delta) * 4));
+    }
   }
 
   // Set the new stack and frame pointer.